CVE Vulnerability Catalog

A SQL injection vulnerability was discovered in iCMS version 7.0.16 via the 'where' parameter in admincp.php. An attacker can exploit this flaw to execute unauthorized database queries.

A command injection vulnerability in the DHCP Client function of all UniFi Access Points and Switches, excluding the Switch Flex Mini, could allow a Remote Code Execution (RCE).

All UniFi Access Points and Switches, excluding the Switch Flex Mini, with SNMP Monitoring enabled and default settings are vulnerable to an integer overflow, potentially allowing Remote Code Execution (RCE).

In version 1.0 of PHPJabbers Document Creator, there is a SQL injection (SQLi) vulnerability in the 'column' parameter of index.php.

CVE-2023-39776 describes a vulnerability in PHPJabbers Ticket Support Script v3.2 that allows attackers to execute arbitrary code by uploading a crafted file.

EZ softmagic MP3 Audio Converter version 2.7.3.700 was found to contain a buffer overflow vulnerability.

Code-Projects Online Hospital Management System V1.0 is vulnerable to SQL Injection attacks, allowing an attacker to manipulate SQL queries executed by the application. The application fails to properly validate user-supplied input in the login id and password fields.

Crypto wallets implementing the Lindell17 TSS protocol may allow an attacker to extract the full ECDSA private key by exfiltrating a single bit in every signature attempt, totaling 256 bits. This issue arises from not adhering to the security proof's assumptions regarding handling aborts after a failed signature.

Crypto wallets implementing the GG18 or GG20 TSS protocol might allow an attacker to extract a full ECDSA private key by injecting a malicious pallier key and cheating in the range proof. Depending on the Beta parameters chosen in the protocol implementation, the attack might require 16 signatures or more fully exfiltrate the other parties' private key shares.

Code-Projects Gym Management System V1.0 allows remote attackers to execute arbitrary SQL commands via the login form, leading to unauthorized access and potential data manipulation.

KramerAV VIA Connect (2) and VIA Go (2) devices before version 4.0.1.1326 allow remote extraction of the connection confirmation code, bypassing the need for physical screen access and enabling remote device manipulation.

A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary system commands.

The Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 is vulnerable to XSS via openAction in app/controllers/OPNsense/Cron/ItemController.php.

Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to access sensitive information (e.g., hashed root password) which could lead to privilege escalation.

A command injection vulnerability in the diag_backup.php component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary commands via a crafted backup configuration file.

Version 1.0.9 of the uthenticode library has a vulnerability that allows an attacker to modify code within a binary file without changing its Authenticode hash, violating the Authenticode specification.

CSZCMS version 1.3.0 has a SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via the p parameter or the search URL.

The vulnerability related to the use of a hard-coded cryptographic key in the Kunduz - Homework Helper app allows for authentication abuse and bypass. This issue affects versions of the app before 6.2.3.

Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead to arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction.

Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server through version 9.2.1.